THE RISKS OF USER IMPERSONATION

Summary from the TLDR InfoSec newsletter

This article dives deep into user impersonation risks and mitigations, which is a common way to allow logging in as another user. This feature is often implemented by changing the sub property of a JWT but is inherently problematic as it requires maintaining an admin list and securing the feature, is insecure by design, and also muddies audit trails. One possible solution is to add a new claim to the JWT but this is error prone and instead advocates for using DOM recording to collect as much sanitized data about a user's session as possible instead.